Topic: SSL Error on Iphone iOS 9 OX Capitan

[seb]

Hi Forum,

I been using iphone iOS 8 with email to our office SME. SSL enable at both sides for external access.

Today i upgrade my iOS to version 9 from Apple, and also my OSx El Capitan, and both give me error on retrieving email. When im on LAN and disable SSL from the clients email retrieve just fine... maybe something with the SSL?

Thanks for any hint!

Cheers.
Seb

[Daniel B.]

Well, it depends, which error do you get ?

[seb]

Well, it depends, which error do you get ?

From the Client side just "server not responding"... let me know hoy to get you logs on the server side...
Thx.

[Daniel B.]

This looks more like a closed port than an SSL issue. Is there some router or firewall in front of your SME Server ?

[mmccarn]

Since your system used to work w/ Yosemite & iOS 8 there might be a problem related to SSL changes. 

I can't find anything talking about this online in relation to either iOS9 or El Capitan, but -

If Apple has changed the default SSL settings (as have Chrome & Firefox over the last year) to prevent the use of old/insecure SSL features, then you may need to either update the SSL configuration on your server or figure out how to convince your Apple devices to permit you to use the old/broken features.

Here's a bug that talks about email not working after updating users to Windows 8.1, presumably related to SSL / TLS1.2:
http://bugs.contribs.org/show_bug.cgi?id=8854

[seb]

Thanks mmccarn, i think is SSL related too.

Do you know from the SME side how can i upgrade the SSL package?

thanks.

[Daniel B.]

Unless you haven't told us everything you know, I see nothing in "server not responding" which could point to an SSL related problem

[seb]

Unless you haven't told us everything you know, I see nothing in "server not responding" which could point to an SSL related problem

Daniel, as i posted initially when i disable SSL email retrieve works just fine... i really never see nothing on error notice popus on apps side instead we are looking on logs...

[Stefano]

Thanks mmccarn, i think is SSL related too.

ATM we have no evidence of it

Do you know from the SME side how can i upgrade the SSL package?

without having no clue about what's going wrong and without any kind of info about your issue, no upgrade is a solution (for any meaning of the word "upgrade")

please, take a look at logs on your mac side (mac is an unix, so similar to linux/SME and it has /var/log directory) and file a new bug, thank you

[janet]

seb

....i think is SSL related too.
Do you know from the SME side how can i upgrade the SSL package?

I think you are probably jumping to (wrong) conclusions here. There is nothing to support your idea that an upgraded ssl package will solve the problem.
For starters you have not even identified the problem. Just saying that you can turn SSL off on the LAN does not prove there is something wrong with the SSL package in SME server.

I just upgraded my iPhone 5 to iOS9, & I am remotely accessing mail on a SME8.1 server using IMAP & SMTP on ports 465 & 993 & it works correctly, both before & after the upgrade, so I do not think that either SME8.1 packages or iOS9 or both together are the problem.
You need to look harder & find what & where the problem is BEFORE you propose fixes for it.

Did you check the settings on iPhone, in Settings, Mail, select account & check.

There are questions asked which you have not answered, people here cannot help you unless you provide the feedback requested, please re-read all the posts & carefully answer every single question that has been asked, & supply all relevant information. Start looking in the qpsmtpd logs on SME server for starters.

Try a different phone & see what happens.
Try a different email client on a different remote PC eg Windows with Thunderbird using the same port & SSL settings etc & see what happens.

[Brenno]

I can confirm what Seb has reported here.

Using iPhone 6 with iOS 8 last night worked fine in conjunction with SME 7.6 server for access via IMAPS on 993/465.  Immediately after updating to iOS 9, I only get the message "Cannot get mail.  The server xxxx.xx is not responding.  Verify that you have entered the correct account info in Mail settings."  Of course, I have done that and I have also completely removed the account from the phone and re-added it to no avail.  IMAPS access is fine from alternate clients such as Thunderbird (< 31.2.0), iOS 8 and Android devices.

This makes me think that, as mmccarn proposed, Apple has quietly dropped support for older versions of SSL; we went through a similar situation last year when Mozilla changed SSL support starting in Thunderbird in version 31.3.0; we were able to work around that by locking the version at 31.2.0 for clients who access the server remotely.

This article seems to lend support to the idea, too:

https://blog.winkelmeyer.com/2015/07/update-your-ssl-on-servers-to-support-tls-1-2-before-ios-9-and-os-x-10-11/

Aside, yes - I know that 7.6 is very outdated, so let's not get into that conversation here.  The question for me, at least while still on this version of SME - and apparently on newer versions, too - is can we update these boxes to work with the new SSL requirements?

[janet]

Brenno

I can confirm what Seb has reported here.

Your report is about a totally different scenario, you are using SME7.6, seb is using SME8.1 (by assumption of course as the post was in the SME8 forum & the server is fully updated).
There were a lot of changes between SME7.6 & 8.0 (8.1) that could be involved, please read the release notes for SME8.0.

"Cannot get mail.  The server xxxx.xx is not responding.

You really need to review log files on your sme7.6 to get more specific details & error messages, there are usually strong clues provided in log files as to the nature of the problem.

....Apple has quietly dropped support for older versions of SSL.....

Well that is a possibility, needs further investigation.

Re your SME7.6:
I doubt very much that anybody here or externally will do any work on updating SME7.6 packages, that version is obsolete (by quite a few years), & it is a relatively easy exercise to upgrade to SME8.1 (at least) which can be achieved by CD or yum upgrade.
My recommendation of course would be to move to SME9.0 or even 9.1beta2 (note that 9.1 final is soon to be released)

If there is resistance to upgrading, then tell them that SME7.6 is insecure (which it is) & the server needs newer packages or whatever to work with newer external devices etc.
If you are using SME7.6 on public networks for email, which you imply you are, then you are running an insecure server, it's as simpe as that.

Your problem may simply be related to using a very old SME 7.6 server.

....Aside, yes - I know that 7.6 is very outdated, so let's not get into that conversation here.

Well it is hard not to get involved in that sort of discussion, becasuse it is necessary.

....The question for me, at least while still on this version of SME - and apparently on newer versions, too - is can we update these boxes to work with the new SSL requirements?

Well that is not strictly true about newer versions of SME server.
In my post immediately before this one, I demonstrated that iOS 9 on an iPhone 5 can access mail on a SME8.1 fully updated server, using SSL on ports 465 & 993, so it does work OK (for me), both sending & receiving.
That suggests there will be localised issues if it is not working correctly for seb.
So to me that is suggestive that there is no inherent problem (fault) with either device or the combination of the two (iOS 9 & SME8.1).

I think for you it may be time to do an upgrade to SME8.1. You could test it out in a VM first if you want proof.

I will try shortly with a SME 9 & 9.1b2 servers, but I expect all will be OK.
I will also access a iPhone 6+ later today & test that too.

Probably as has already been suggested, this original post by seb would be best reported as a bug, & then proper investigation can be done.

[seb]

Guys,
Just notice that our server is still in 7.2, and not only that's the problem... when trying to yum update we notice the templates on yum repos are modified by a company that uses to host other apps on the SME Server.

I'll post the yum issue im having in order to get advice on how to restore the 7.2 yum file and move to 8.

Thanks
Seb

[janet]

seb

I'll post the yum issue im having in order to get advice on how to restore the 7.2 yum file and move to 8.

OK then SME7.2 is probably the source of your problem.

I will suggest you avoid using yum to upgrade your server.
The repos are now archived & the names have changed & as there were many changes made in the SME7 point releases between 7.2 & 7.6, there are & will be issues for you when using yum.
Even the correct versions of yum packages & smeserver-yum are required & it can be a fiddly exercise getting the right packages installed that will facilitate a smooth upgrade as well as configuring repo locations to get these packages.
There are examples of this in the forums where users have upgraded to sme8 a long time after the repos were archived, & the instructions that need to be given depend very much on the server in question etc.
It can be quite time consuming & difficult to give advice on.

As such I STRONGLY suggest you upgrade using CD, it will be quicker & easier.
Do first the CD upgrade to SME7.6 & then do the CD upgrade to SME8.1 & that will be as smooth as possibly can be.

Advice in these forums etc a few years back, was that when upgrading to SME8.0, users should bring their server to at least v7.6 before running the upgrade. Many packages changed & the upgrade simply works better without complications if you do a 2 stage upgrade.

Make sure you remove all custom templates when/before doing the upgrade to SME8, & make sure you reset all repos using the master reinitialise repo command after the upgrade (it is important to remove all old sme7 repos), ask again if you cannot find the command, but look at FAQ under repositories.

I for one do not want to give advice on doing a yum upgrade at this late stage, it is too tricky to resolve.
Please go the CD upgrade route.

[janet]

To all

Just tested this, iOS 9 on iPhone 5 works OK with SME 9.1beta2 sending & receiving mail remotely using IMAPS & SSMTP on ports 993 & 465
In the iphone setup I selected SSL/TLS accept all certificates

[Stefano]

so we got a 7.2 and 7.6.. OT in this forum

@brenno and seb: your SME are in EOL since a long time, they are unsupported.. please move asap to 8.1 or, better, to 9.

moving this topic to general discussion

[Brenno]

For clarity, I was never suggesting there was an issue with the SME product.  I was merely indicating that seb's experience was mirrored by my own.  When I have issues I often turn to this forum to see if they've been reported by anyone else; it's an important diagnostic step, IMO, so I feel there's value in somebody saying "Yeah, me too!".

But, to reiterate, this is definitely a change in iOS 9.  I was able to connect to my 7.6 box without issue from devices still running iOS 8.  We don't officially support iOS so I'm not obligated to try to fix this, but nonetheless it's a pain in the a$$ and I'd prefer that there be an option to patch the SSL issue rather than have to upgrade the entire machine.  Is there nothing from CentOS on this?

IIRC, jumping to SME 8 will force all internal clients to authenticate for SMTP, so that will also mean touching all inside clients to make that change, too.

[Daniel B.]

but nonetheless it's a pain in the a$$ and I'd prefer that there be an option to patch the SSL issue rather than have to upgrade the entire machine.  Is there nothing from CentOS on this?

No, SME7, just as its upstream CentOS 4 are EOL, which means there'll be no further update (be it bug fix, new feature, or even security).

IIRC, jumping to SME 8 will force all internal clients to authenticate for SMTP, so that will also mean touching all inside clients to make that change, too.

No, you can disable this feature (even if it's not recommended, but you can at least disable it for some time, and once every client has auth enabled, you can turn it back on)

[janet]

Brenno

My answer is the same as Daniel.

No one upstream is working on obseleted end of life software, that is why they release new versions of CentOS which are in SME 8 & SME 9
If you want updated packages you have to use the new OS in it's entirity, unless you personally want to try & release suitable patches, but good luck, in my opinion it's far easier to upgrade.

A simple db command can disable authenticated smtp in SME 8, as Daniel says it is not recommended practice, but it can be done

You could have carried out the upgrade in the time it has taken to post here & answer these posts !

[Fumetto]

I can confirm "bug"; iPhone update to IOS 9 and got error on mail sistema with SME8.x full updated.

I hate Apple's software...

A part of imaps log

2015-09-18 19:50:47.323437500 2015.09.18 19:50:47 LOG3[8299:47380366448768]: SSL_read (SSL_ERROR_SYSCALL): Connection timed out (110)
2015-09-18 19:50:47.323493500 2015.09.18 19:50:47 LOG5[8299:47380366448768]: Connection reset: 4362 bytes sent to SSL, 298 bytes sent to socket
2015-09-18 19:50:47.324444500 imap(amministrazione): Info: Connection closed: Connection reset by peertcpsvd: info: end 8299 exit 0
2015-09-18 19:50:47.324547500 tcpsvd: info: status 3/400
2015-09-18 19:50:47.324590500
2015-09-18 19:51:28.840920500 2015.09.18 19:51:28 LOG3[8301:47759673518208]: SSL_read (SSL_ERROR_SYSCALL): Connection timed out (110)
2015-09-18 19:51:28.840975500 2015.09.18 19:51:28 LOG5[8301:47759673518208]: Connection reset: 17076 bytes sent to SSL, 1511 bytes sent to socket
2015-09-18 19:51:28.841650500 imap(amministrazione): Info: Connection closed: Connection reset by peer

[Brenno]

I'm looking to do the upgrade over the weekend.  I have 8.x on DVD already, so it's just a matter of going onsite and working it through.

Regarding the reinitialization of the master yum repositories, is that what this link is instructing?  It's worded a little differently so I wanted to verify.

Can you give more details as to disabling the need for authentication for SMTP on the LAN side?  I did some searching and couldn't located that part - and I'm assuming it's not the same as what's found in the server manager > email settings > smtp authentication since that drop-down strikes me as affecting all SMTP connections, not just internal.

[janet]

Fumetto

I can confirm "bug"; iPhone update to IOS 9 and got error on mail sistema with SME8.x full updated.

Perhaps you missed my previous post here
http://forums.contribs.org/index.php/topic,51944.msg265190.html#msg265190

iOS 9 on an iPhone 5 works OK for me using IMAPS & SSMTP (SSL all certificates) collecting/sending mail remotely on a SME8.1 server, so there does not seem to be an inherent bug in iOS 9 that stops all users.
Since then I tested on SME9.1beta2 & works OK there too.

You really need to report a bug in bugzilla if you want a better answer, & be prepared to supply log files & further information as requested.

[janet]

Brenno

Regarding the reinitialization of the master yum repositories, is that what this link is instructing?  It's worded a little differently so I wanted to verify.

Yes that's it.

Can you give more details as to disabling the need for authentication for SMTP on the LAN side? 

See the release notes, by the way 8.0 was released on 26 May 2012 which is along time ago.
You are likely to need (be forced)  to upgrade in another year or so, so why not move to SME 9.x now.
Requires backup & restore though, as all upgrades to v9.0 are not supported (due to underlying CentOS constraints)

See
http://forums.contribs.org/index.php/topic,48671.0.html
under Major changes since beta 7 & Mail server
Require authentication for all emails, including local.
under Mail Server
Require SMTP authentication by default when sending to an external address.

The email Howto is a good place to look re how to disable this
http://wiki.contribs.org/Email#How_do_I_disable_SMTP_relay_for_unauthenticated_LAN_clients

Also discussed here
http://forums.contribs.org/index.php/topic,48650.msg241849.html#msg241849
& here
http://bugs.contribs.org/show_bug.cgi?id=5575

Authenticated smtp is a good feature to stop viruses or hackers making use of your mail engine, so the better approach is to change settings on email clients.

[Brenno]

janet,

Looking at the links you've provided, I'm going to use the following commands to disable the need for authentication on the LAN:

Code: [Select]

mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local
cp /etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/05auth_cvm_unix_local .
signal-event email-update

config setprop qpsmtpd Authentication disabled
signal-event email-update

Hopefully these are the right steps; I don't want to inadvertently enable outside relaying.  But, I'm nervous about having the authentication required on the LAN side as I need more time to assess what production equipment might be impacted in addition to getting all workstations updated.  Plus, I'm traveling all next week and can't be onsite.  Game plan is to enable this feature ASAP.

Post-upgrade script is running right now 

[Daniel B.]

Or you can just:

Code: [Select]

db configuration setprop qpsmtpd RelayRequiresAuth disabled
signal-event email-update


[Brenno]

Have completed the CD upgrade from 7.6 to 8.1 and disabled qpsmtpd as suggested - tested and seems to be working fabulously.

Yum is not working though; it says:

Code: [Select]

Could not retrieve mirrorlist http://mirrorlist.contribs.org/mirrorlist/smeaddons-8 error was [Errno 4] IOError: <urlopen error (-3, 'Temporary failure in name resolution')>

Cannot find a valid baseurl for repo: smeaddons

I enabled the default respositories as above, ran a yum clean clean all and validated that the repositories were enabled with /sbin/e-smith/audittools/repositories

I can bring the URL up in my web browser just fine and I can ping contribs.org from the SME box.  I cannot ping mirrorlist.contribs.org from the SME box, though.

[janet]

Brenno

Mirrors appear to be OK
http://mirror.contribs.org/mirrors/

Did you do:

cd /home/e-smith/db/
mv yum_repositories yum_repositories.po
/etc/e-smith/events/actions/initialize-default-databases
signal-event yum-modify

then (although it should not be necessary)
yum clean all --enablerepo=*

then
yum update

[Brenno]

Hi Janet,

Yes - ran all those commands verbatim (three times now).  It hangs on "determining fastest mirrors" and then eventually comes up with the temporary resolution error message above.

The SME server cannot ping mirrorlist.contribs.org; it comes back unknown host.  Pinging contribs.org and forums.contribs.org is fine.  Can ping all three is OK from my Win7 workstation.

Edit: I added Google's DNS (8.8.8.8 ) to the Domains page in server-manager and yum is now happily running!

[Brenno]

Worse fears realized!

Box was running well before yum update.  After the update finished and the machine rebooted, it tells me that there's a problem with the superblock on /dev/sdb1 (which is a USB drive that I use for AFFA).

Now stuck in an endless cycle of rebooting to the error and then having to restart again.  Going to try to re-install from CD to see what happens.

[Brenno]

Ok, I don't know what happened, but I used recovery mode from the installer CD to edit out the drive in /etc/fstab and rebooted just fine.  Once booted I can mount the external drive and browse contents just fine, but for some reason it sure doesn't like trying to boot with the drive already there!

I'll leave that for another day; I believe AFFA should auto-mount the drive anyway so if the machine is rebooted it won't matter that it's not in /etc/fstab.

Anyway, enough of me rambling on in this thread!  To return to the original topic, the upgrade from 7.6 to 8.1 has restored access to IMAP accounts on iOS 9 devices.

[janet]

Brenno

Perhaps you missed this advice.
ALWAYS disconnect USB drives when doing upgrades, particularly when installing new OS's.
If not you risk the USB drive being included in the RAID array, (even as a spare).
You better check the USB drive just in case.

Otherwise as indentified the system is just trying to boot to USB.

Good that the SME upgrade did resolve the iOS 9 issue.

[Brenno]

Janet,

I definitely unplugged the USB drive before I performed the upgrade because I didn't want to risk the integrity of the data that was on it.  After the upgrade, during the first reboot, I plugged the USB drive back in and it said that the disk hadn't been checked in 537 days and it was forcing a check.  I waited that out and the bad superblock error showed up after loading udev (I think).  I rebooted the machine and it proceeded normally to a login prompt so I dismissed it as perhaps a temporary glitch.

Then, after getting yum to run, I had to reboot again and that's when I got stuck and couldn't get past the bad superblock error.

Output of df -h is:

Code: [Select]

[root@mail ~]# df -h
Filesystem              Size  Used Avail Use% Mounted on
/dev/mapper/main-root
                      266G  177G   76G  71% /
/dev/sda1              99M   20M   75M  21% /boot
none                  4.0G     0  4.0G   0% /dev/shm
/dev/sdb1             917G  230G  641G  27% /mnt/affa

Perusal of the contents of /mnt/affa look as expected, so hopefully everything is OK.  Will know more when AFFA runs tomorrow AM.

[stefan24]

I can confirm, that SME server 7.6 (certainly not the latest patchlevel) with two devices just upgraded to IOS 9 does not work using SSL (server xx.xx.xx.xx not responding). So I backed up the server last night, restored it to existing (new) SME 8.1 server, I had already prepared and IOS9 devices could connect to the 8.1.

BTW: sending mails from that IOS9 devices was okay in SME 7.6 (I know, that's another protocol).

[CharlieBrady]

I can confirm, that SME server 7.6 (certainly not the latest patchlevel) with two devices just upgraded to IOS 9 does not work using SSL (server xx.xx.xx.xx not responding).

Please do a tcpdump packet capture while that "not responding" error is occurring. We need to know what "not responding" means.

[CharlieBrady]

Looks like it is happening not just with SME server:

http://apple.stackexchange.com/questions/206448/imap-account-stopped-working-after-upgrade-to-ios-9-problem-with-cacert-certif

Note the report that even imap.gmail.com can show a problem.

So it looks like iOS9 doesn't properly report untrusted certificates following STARTTLS over IMAP.

[edb]

I had this issue as well with the Apple iOS 9 update and it was resolved by installing the e-smith-pop3-2.2.0-8.el5.sme update on my SME8x server.
User suddenly were unable to retrieve POP3 port 995 email but they could send email fine on port 465.
I do beleive it is an SSL issue that was resolved by the POP3 update.

[CharlieBrady]

Your report is about a totally different scenario, you are using SME7.6, seb is using SME8.1 (by assumption of course as the post was in the SME8 forum & the server is fully updated).

Now you are jumping to conclusions. Seb never said that the server was fully updated, and apparently it wasn't.

[janet]

Now you are jumping to conclusions. Seb never said that the server was fully updated, and apparently it wasn't.

Well I did say "assumption".
....and my comment appears to have prompted seb to supply more specifc details not previously supplied ie that it was a SME 7.2 server.

[seb]

Hi Guys,
after my upgrade from 7.2 to 9.0 now i got my iOS 9 working with SSL enabled.
Now i will be up to date on my SME box in order not to get into trouble... and probably try to get the best of it by installing some joomla and sugercrm on it 

thanks Guys!
 

[edb]

So how long will we be able to remain at TLS 1 since most apps in the near future will likely require TLS 1.2 with forward secrecy?
https://blog.winkelmeyer.com/2015/07/update-your-ssl-on-servers-to-support-tls-1-2-before-ios-9-and-os-x-10-11/
This could pose big issues from what I read above as an example but at this point everything still works fine with TLS 1
My understanding is that it won't be doable with SME Server 8x but may be doable with SME version 9x based on CentOS 6.
Just curious but I don't know squat about the potential issues or complications.

Big thanks to the developers for all their hard work!

[janet]

edb

Please post a bug raising your concerns, the devs can take a look at the issues.
Thanks

[Stefano]

My understanding is that it won't be doable with SME Server 8x

it depends on upstream updates..
anyway, SME8 is going to be in maintenance mode, i.e. bugfixing only.. and nowaday installing a new SME8 doesn't make sense since SME9 is the way to go.